TTL Jumps: Unexpected TTL Rewrites Impacting Inferences from Traceroutes#

Tobias Fiebig, TU Wien, and Johannes Zirngibl, Max Planck Institute for Informatics

• Why: A systematic blind spot in the field's most-used measurement tool: some devices rewrite TTL (often to 255), hiding the rest of the path and corrupting topology inference — and the affected paths include a large fraction of one major Tier-1's IPv6 network.
• What: At least 47 ASes contain path-impairing devices that rewrite TTL. The flagship example: more than 90% of outgoing IPv6 paths from CAIDA Ark nodes have been affected at AT&T since 2023. Measurement towards a single node found 365 probes (138 IPv4, 236 IPv6) seeing rewrites, with 63 ASes implicated on-path; extending to all IPv4 RIPE Atlas traces, 1.8M traces end in ICMP errors, 86.3k contain a TTL > 1, and 23.1k are genuine rewrites (others are liveness probes using TTL 255 after five unresponsive hops).
• How: Controlled experiments plus public RIPE Atlas and CAIDA Ark data; the authors distinguish true rewrites from liveness-check artifacts and trace where along the path the rewriting happens.
• Where applicable: Anyone building topology inference, AS-link datasets, or traceroute-based triage tooling — the spurious-router/AS-link failure mode directly affects measurement products the PM may depend on.